Are you sure it's userspace accessible? Based on https://github.com/saagarjha/TSOEnabler/blob/master/TSOEnabler/TSOEnabler.c https://github.com/saagarjha/TSOEn

Are you sure it's userspace accessible? Based on https://github.com/saagarjha/TSOEnabler/blob/master/TSOEnabler/TSOEnabler.c https://github.com/saagarjha/TSOEnabler/blob/master/TSOEnabl..., it's a field in ACTLR_EL1, which is explicitly (per the ARMv8 spec, at least...) not accessible to userspace (EL0) execution. There may be some kernel interface to allow userspace to toggle that, but that's not the same as being a userspace-accessible SCR (and I also wouldn't expect it to be passed through to a VM - you'd likely need a hypercall to toggle it, unless the hypervisor emulated that, though admittedly I'm not quite as deep weeds on ARMv8 virtualization as I would prefer at the moment.